diff --git a/.gitea/workflows/build-windows.yml b/.gitea/workflows/build-windows.yml
index a0f68acb3..b2e34520f 100644
--- a/.gitea/workflows/build-windows.yml
+++ b/.gitea/workflows/build-windows.yml
@@ -81,15 +81,51 @@ jobs:
           echo "--- Cargo.toml [package] ---"
           awk '/^\[package\]/{f=1} f; /^\[/&&!/^\[package\]/{f=0}' Cargo.toml | head -10
 
-      - name: Install flutter_rust_bridge codegen tools
-        shell: bash
+      - name: Ensure Rust toolchain configured for runner user
+        shell: pwsh
         run: |
-          cargo install cargo-expand --version "${CARGO_EXPAND_VERSION}" --locked || true
-          cargo install flutter_rust_bridge_codegen --version "${FLUTTER_RUST_BRIDGE_VERSION}" --features uuid --locked || true
+          # provision.ps1 ran rustup as an admin user; act_runner runs as LocalSystem
+          # which has its own (empty) $RUSTUP_HOME. Bootstrap the default toolchain
+          # for LocalSystem on first run -- subsequent runs are no-ops.
+          rustup --version
+          rustup toolchain install $env:RUST_VERSION --profile minimal --component rustfmt
+          if ($LASTEXITCODE -ne 0) { throw "rustup toolchain install failed ($LASTEXITCODE)" }
+          rustup default $env:RUST_VERSION
+          if ($LASTEXITCODE -ne 0) { throw "rustup default failed ($LASTEXITCODE)" }
+          rustup target add x86_64-pc-windows-msvc
+          rustc --version
+          cargo --version
+
+      - name: Install flutter_rust_bridge codegen tools
+        shell: pwsh
+        run: |
+          # Pin the install destination with --root so we don't have to guess at
+          # the runner's $USERPROFILE (act_runner runs as LocalSystem on this host,
+          # which makes $USERPROFILE a non-obvious system path).
+          $tools = 'C:\cargo-tools'
+          New-Item -ItemType Directory -Force -Path "$tools\bin" | Out-Null
+
+          cargo install --root $tools cargo-expand --version "$env:CARGO_EXPAND_VERSION" --locked
+          if ($LASTEXITCODE -ne 0) { throw "cargo install cargo-expand failed ($LASTEXITCODE)" }
+
+          cargo install --root $tools flutter_rust_bridge_codegen --version "$env:FLUTTER_RUST_BRIDGE_VERSION" --features uuid --locked
+          if ($LASTEXITCODE -ne 0) { throw "cargo install flutter_rust_bridge_codegen failed ($LASTEXITCODE)" }
+
+          Write-Host "--- $tools\bin ---"
+          Get-ChildItem "$tools\bin" | Format-Table Name, Length, LastWriteTime
+
+          $expected = Join-Path $tools 'bin\flutter_rust_bridge_codegen.exe'
+          if (-not (Test-Path $expected)) { throw "missing: $expected" }
+
+          Add-Content -Path $env:GITHUB_PATH -Value "$tools\bin"
 
       - name: Generate Rust <-> Dart bridge
         shell: bash
         run: |
+          # Belt-and-suspenders: also prepend cargo-tools to PATH here, in case
+          # GITHUB_PATH propagation from the previous step doesn't take effect.
+          export PATH="/c/cargo-tools/bin:$PATH"
+          command -v flutter_rust_bridge_codegen || { echo "tool not on PATH; PATH=$PATH"; exit 1; }
           pushd flutter && flutter pub get && popd
           flutter_rust_bridge_codegen \
             --rust-input ./src/flutter_ffi.rs \
diff --git a/ci/runners/windows/provision.ps1 b/ci/runners/windows/provision.ps1
index a9004c1ee..28c632375 100644
--- a/ci/runners/windows/provision.ps1
+++ b/ci/runners/windows/provision.ps1
@@ -54,6 +54,7 @@ choco install -y --no-progress `
     git python311 nuget.commandline 7zip cmake ninja `
     nodejs-lts powershell-core dotnet-sdk
 Add-MachinePath 'C:\Program Files\Git\cmd'
+Add-MachinePath 'C:\Program Files\Git\bin'   # bash.exe + posix tools (sed, find, etc.)
 Add-MachinePath 'C:\Python311'
 Add-MachinePath 'C:\Python311\Scripts'
 Add-MachinePath 'C:\Program Files\nodejs'
@@ -81,11 +82,21 @@ if (-not $vsPresent) {
 }
 
 # --- 3. Rust (stable 1.75 + nightly-2023-10-13 with i686 target) ---
-if (-not (Get-Command rustup -ErrorAction SilentlyContinue)) {
-    Write-Host '==> Installing rustup'
+# Install machine-wide so the act_runner service (LocalSystem) and any admin user
+# share the same toolchain registry. Without this, rustup state lives in the
+# installing user's profile and LocalSystem ends up with no default toolchain.
+$rustupHome = 'C:\rustup'
+$cargoHome  = 'C:\cargo'
+[Environment]::SetEnvironmentVariable('RUSTUP_HOME', $rustupHome, 'Machine')
+[Environment]::SetEnvironmentVariable('CARGO_HOME',  $cargoHome,  'Machine')
+$env:RUSTUP_HOME = $rustupHome
+$env:CARGO_HOME  = $cargoHome
+Add-MachinePath "$cargoHome\bin"
+
+if (-not (Test-Path "$cargoHome\bin\rustup.exe")) {
+    Write-Host '==> Installing rustup (machine-wide at C:\rustup, C:\cargo)'
     Invoke-WebRequest -Uri 'https://win.rustup.rs/x86_64' -OutFile "$env:TEMP\rustup-init.exe"
     & "$env:TEMP\rustup-init.exe" -y --default-toolchain none --profile minimal
-    Add-MachinePath "$env:USERPROFILE\.cargo\bin"
 }
 rustup toolchain install $RUST_VERSION --profile minimal --component rustfmt
 rustup target add --toolchain $RUST_VERSION x86_64-pc-windows-msvc